CVE-2017-0199
Microsoft Office and WordPad Remote Code Execution Vulnerability
Description
CVE-2017-0199 is a high-severity remote code execution vulnerability in Microsoft Office and WordPad. The vulnerability allows an attacker to execute arbitrary code by convincing a user to open a specially crafted document that contains an embedded OLE2link object, which fetches and executes a malicious HTA (HTML Application) file from a remote server. This Microsoft Office vulnerability has been extensively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. With an EPSS score of 94.33% (99.7th percentile) and confirmed use in ransomware campaigns, CVE-2017-0199 remains one of the most actively targeted document-based attack vectors.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2007; 2010; 2013; 2016 |
| microsoft | windows 7 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | - |
| microsoft | windows vista | - |
| philips | intellispace portal | 7.0; 8.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html(Exploit, Third Party Advisory)
- http://www.securityfocus.com/bid/97498(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038224(Broken Link, Third Party Advisory, VDB Entry)
- https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/(Exploit, Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41894/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41934/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42995/(Third Party Advisory, VDB Entry)
- https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html(Broken Link, Exploit, Third Party Advisory)
- https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199(US Government Resource)
Weakness Type
This CVE has no CWE classification assigned in the NVD database. The vulnerability involves improper handling of OLE2link objects in Microsoft Office documents, which allows remote code execution through the Windows HTA handler. The underlying weakness relates to the way Microsoft Office processes embedded objects that can reference external content, enabling an attacker to deliver and execute malicious payloads through document files.
Impact Analysis
CVE-2017-0199 carries a CVSS 3.1 score of 7.8 (HIGH), representing a severe threat to organizations using affected Microsoft Office versions. The vulnerability requires local access in terms of CVSS classification — the attack is initiated when a user opens a malicious document — but has low attack complexity, meaning no special conditions are needed beyond social engineering the victim into opening the file. Confidentiality (High): Full compromise of data confidentiality is possible, as arbitrary code execution grants the attacker access to all information the user can reach. Integrity (High): The attacker can modify, delete, or corrupt data and install persistent backdoors on the affected system. Availability (High): Complete disruption of system availability is possible through ransomware deployment or destructive payloads. The EPSS score of 94.33% indicates near-certain exploitation activity. The confirmed use in ransomware campaigns and availability of multiple public exploits make this vulnerability extremely dangerous for any organization with unpatched Microsoft Office installations.
Exploit Maturity
CVE-2017-0199 has a highly mature exploit landscape with multiple publicly available exploit tools and proof-of-concept code. Public exploit code is available via Exploit-DB (41894) and Exploit-DB (41934), along with detailed technical analyses from security researchers and NVISO Labs. CISA has confirmed active exploitation in the wild, and the vulnerability is associated with known ransomware campaigns. The EPSS score of 94.33% (99.7th percentile) indicates near-certain exploitation activity, making this one of the most actively exploited Microsoft Office vulnerabilities. The availability of turnkey exploit code through multiple sources, combined with the simplicity of the attack — requiring only that a victim open a document — has made CVE-2017-0199 a favored tool for both cybercriminal groups and advanced persistent threat actors.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released security updates for all affected Office versions through the MSRC advisory.
- Update all affected Microsoft Office installations — Office 2007, 2010, 2013, and 2016 are confirmed vulnerable. Additionally, apply patches to affected Windows systems (Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012) as WordPad is also affected.
- Disable the Windows OLE feature where not required, and configure Microsoft Office to open documents in Protected View by default. Block the execution of HTA files through Group Policy or application whitelisting solutions.
- Deploy email and web gateway protections to filter Office documents with embedded OLE objects from untrusted sources. Configure email security solutions to block or quarantine suspicious RTF and DOC attachments that may exploit this vulnerability.
- Monitor for indicators of compromise including unusual HTA file execution, outbound connections from Office processes to external servers, and unexpected child process spawning from winword.exe or wordpad.exe. Review security logs and conduct threat hunting focused on document-based attack patterns.
Technical Details
CVE-2017-0199 exploits the way Microsoft Office and WordPad handle OLE2link objects embedded in document files. When a user opens a specially crafted RTF or DOCX file, the embedded OLE2link object instructs the application to fetch content from a remote server. The fetched content is an HTA (HTML Application) file, which is then executed by the Windows HTA handler (mshta.exe) outside the Office sandbox. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) classifies the attack vector as local because exploitation requires opening a file, though the malicious document is typically delivered via email or web download. The low attack complexity and lack of privilege requirements mean that any user who opens the document will trigger the exploit, regardless of their system configuration. The HTA execution provides full code execution capabilities, making this an extremely reliable and dangerous attack vector that has been widely adopted in phishing campaigns and malware distribution operations.
Frequently Asked Questions
Is CVE-2017-0199 being actively exploited?
Yes. CVE-2017-0199 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The vulnerability has been associated with ransomware campaigns and is extensively used by both cybercriminal and state-sponsored threat actors. The EPSS score of 94.33% (99.7th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2017-0199?
CVE-2017-0199 affects Microsoft Office 2007, 2010, 2013, and 2016, as well as Microsoft WordPad on Windows Vista, Windows 7, Windows Server 2008 (including R2), and Windows Server 2012. Additionally, Philips IntelliSpace Portal versions 7.0 and 8.0 are affected due to their use of vulnerable Microsoft Office components.
How do I fix CVE-2017-0199?
Apply the security updates provided by Microsoft through the MSRC advisory for all affected Office versions and Windows systems. Enable Protected View in Microsoft Office to prevent automatic execution of embedded objects. As a defense-in-depth measure, disable HTA file execution and implement email filtering to block suspicious document attachments.
How severe is CVE-2017-0199?
CVE-2017-0199 has a CVSS 3.1 score of 7.8 (HIGH). The combination of low attack complexity, multiple public exploits, confirmed ransomware usage, and an EPSS score of 94.33% makes this an extremely high-priority vulnerability. Successful exploitation enables full remote code execution on the victim's system.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.